Data Processing

This page explains the relationship between SalesTrack and shop owners when it comes to data — specifically, who is responsible for what under data protection law, and how SalesTrack processes data on a shop owner's behalf. It's meant to sit alongside, not replace, our Privacy Policy and Terms of Service.

1. Controller and processor roles

Under the Kenya Data Protection Act, 2019 and similar frameworks, two roles matter:

• Data Controller — decides why and how personal data is collected and used. When you run a shop on SalesTrack, you are the Data Controller of your own customers' data (their names, phone numbers, purchase history, appointment history, etc.). You decide what to collect from your customers and why.
• Data Processor — processes data on the Controller's instructions. SalesTrack acts as your Data Processor for your shop's customer data. We store it, back it up, and make it available to you through the app, but we don't decide what your shop collects or why — that's your call as the business owner.

For your own account data as an Account User (your name, email, login, subscription details), SalesTrack is the Data Controller, since we determine why that data is collected — to provide you with the Service.

2. What this means in practice

• You are responsible for telling your own customers how their data will be used (for example, that you'll send them a WhatsApp receipt or appointment reminder) and for getting any consent that applies in your jurisdiction
• We are responsible for keeping the data you enter secure, available, and isolated from other shops on the platform
• We will not access, use, or share your shop's customer data except as needed to operate the Service, provide support, or comply with the law
• If your customer asks you to delete their data, contact us and we will help action this within your account, subject to records we are legally required to retain (e.g. completed transaction records for tax purposes)

3. Sub-processors

We use a small number of trusted infrastructure providers to deliver the Service. These are our sub-processors:

We will notify active Account Users if we add a new sub-processor that materially changes how shop data is handled.

4. Immutable transaction records

A core part of how SalesTrack works: once a sale or stock movement is recorded, it cannot be edited or deleted by anyone — including the shop owner and SalesTrack staff. This is intentional. It protects shop owners from internal fraud or accidental data loss, and it's what makes financial reports (like our Lender Pack feature) credible to banks and lenders. If you need to correct an error, the system requires a new offsetting entry (such as a return or adjustment) rather than altering history. This is a permanent feature of the Service, not a configurable setting.

5. Data location

Your data is hosted on infrastructure that may be located outside Kenya, depending on our hosting providers' data center locations. We select providers that maintain strong security practices, and we apply the same data protection standards regardless of physical server location.

6. Security measures

• Encryption in transit (HTTPS/TLS) for all data sent to and from SalesTrack
• Passwords stored using one-way hashing, never in plain text
• Strict server-side access rules ensuring shop data is only visible to authenticated users belonging to that shop
• Daily backups of the underlying database
• Secrets (such as M-Pesa API credentials) are never exposed in client-side code — they are handled exclusively in secure server-side functions

7. Data export and portability

You can export your shop's sales, customer, and financial data as CSV at any time from within the app. This means your data is never locked in — if you choose to stop using SalesTrack, you can take a copy of your business records with you.

8. Breach notification

If we become aware of a security incident affecting your shop's data, we will notify you without undue delay, with information about what happened, what data was affected, and what steps we are taking, consistent with our obligations under the Kenya Data Protection Act.

9. Your obligations as a Data Controller

As the shop owner, please:

• Only collect customer data you actually need to run your business
• Be transparent with your customers about how you use their data (for example, mention WhatsApp reminders or digital receipts)
• Don't use SalesTrack to store sensitive personal data you don't need (e.g. national ID numbers, medical records) unless your business type genuinely requires it and you have a lawful basis to do so
• Respond reasonably to your own customers' requests about their data, with our support where needed